It’s not so much “But that’s not how you build stable software.” It’s more like “But that’s not how you build software [at all today].” Modern software is powered by loads of shared packages, that’s just how all modern languages work. This is equally true for Rust and Python.
You’re not wrong - all libraries with automated dependency packaging do have this problem. But you’re downplaying the scale by a lot. Javascript dependency graphs are absolutely massive. Python has a decent standard library that reduces the number of shared packages by quite a bit. There are definitely downsides to having a large standard library like Python has, but it does significantly reduce the probability of a supply chain attack compared to Javascript.
I can’t comment on Rust personally, since I don’t have much experience with the ecosystem.
The problem of JavaScript is growing far more than its initial scope. Especially since there wasn’t an official org that took care of JavaScript development (and there were companies that wanted to deliberately sabotage such effort, like… Microsoft), and basically the community took the initiative of providing shared libraries, each one looking at their specific problem but ignoring the whole.
You’re not wrong - all libraries with automated dependency packaging do have this problem. But you’re downplaying the scale by a lot. Javascript dependency graphs are absolutely massive. Python has a decent standard library that reduces the number of shared packages by quite a bit. There are definitely downsides to having a large standard library like Python has, but it does significantly reduce the probability of a supply chain attack compared to Javascript.
I can’t comment on Rust personally, since I don’t have much experience with the ecosystem.
The problem of JavaScript is growing far more than its initial scope. Especially since there wasn’t an official org that took care of JavaScript development (and there were companies that wanted to deliberately sabotage such effort, like… Microsoft), and basically the community took the initiative of providing shared libraries, each one looking at their specific problem but ignoring the whole.